Questions and Answers.pdf

1. Is a DD-254 required for this eƯort?

a. A DD-254 is required. Contractors will be responsible for handling and safeguarding classified material up to TS/SCI.

2. Is this a current requirement, and who is the incumbent?

a. There is no incumbent. This is a new requirement because this is a newly built SCIF.

3. Are CPARs an acceptable alternative to a PPQ?

a. CPARS is acceptable.

4. Page 6 of 56 of the current RFP states all documents must be submitted at or before July 18, 12 PM EST. Will this due date be updated in an amendment?

a. RFP has been updated to reflect new deadline of 8/26/2025.

5. What is the current state of the SCIF’s accreditation? Is it currently active, and when is the next scheduled assessment?

a. The SCIF is brand new and has not yet been accredited. Having an SSO is required for accreditation, which is the purpose of this contract. We hope to accredit the space with the Authorizing Official (CG-221) on September 29, 2025.

6. What specific systems and technologies are currently in use within the SCIF that require security management?

a. Nothing is currently installed, but we will have JWICS, SIPR, CGone, JWICS VTC, and JWICS phones once everything is done.

7. What is the approximate number of personnel with SCI access who will be supported by this position?

a. At least 30 personnel just on CGD-O staff, however that number increases to approximately 100 if you include expected usage from other local commands, not to mention expected classified briefs to authorized visitors and partners.

8. Are there any anticipated changes to the SCIF’s physical layout or operational procedures in the near future?

a. No anticipated changes. The SCIF is brand new and designed for current needs.

9. What is the reporting structure for this SSO position, and to whom will the SSO directly report?

a. The SSO will report to CGD-O DRI (intel) branch chief.

10. Beyond ICD 705 and COMDTINST M5500.27, are there other Coast Guard directives or local policies the SSO must follow?

a. The SSO will be subject to general local directives put in place by CGD-O. No other policies I am aware of.

11. What is the Coast Guard’s current process for reporting security incidents and breaches?

a. The Coast Guard's current process for reporting security incidents and breaches involves the on-site Security Officer (SSO) taking primary

70Z08425QHONO0002001 Q&A

responsibility for investigation. The SSO then routes the incident report up the chain of command, escalating to the Pacific Area (PACAREA) SSO and ultimately to Coast Guard Headquarters (CG-22). Specific policies and procedures are detailed in the local Standard Operating Procedures (SOPs), which are derived from Chapter 5 of the CIM M5500.27, Coast Guard Sensitive Compartmented Information Security Administration Manual .

12. What training resources are available to the SSO to maintain current knowledge of evolving security threats and regulations?

a. To maintain current knowledge of evolving security threats and regulations, the USCG SSO has access to a wealth of training resources. These include unlimited access to the Center for Development of Security Excellence (CDSE) Computer-Based Training (CBTs) and a dedicated budget for formal, specialized SSO training, such as courses covering Intelligence Community Directives (ICD) 704 and 705.

13. Are there any specific cybersecurity frameworks (e.g., NIST, CMMC) the Coast Guard aligns with, and how does that affect SCIF security?

a. The Coast Guard aligns with cybersecurity frameworks, including NIST's Risk Management Framework, to maintain a strong network security posture, directly impacting SCIF security. An on-site Information Systems Security Officer (ISSO) is responsible for implementing and maintaining these security controls. Key directives and policies governing this alignment include Intelligence Community Directives 503 and 503-3, the Coast Guard Sensitive Compartmented Information Security Administration Manual, CNSS Instruction 1253, and DoD Directives/Instructions 8140.01/02/03 and 8570.01, alongside Coast Guard-specific governance COMDTINST 5500.13I.

14. What budget, personnel, and tools will be available to the SSO to manage the SCIF’s security program effectively?

a. Currently identified recurring costs of approximately $60K have been identified. There will likely be additional budget available if needed, but the amount is not known at this time.

b. There will be no personnel working directly for the SSO. There will be many parties working with the SSO and assisting with various tasks and management aspects of the SCIF.

15. Is there an existing security team or support staff the SSO will work with?

a. The SSO will work closely with FASSO Honolulu and the PACAREA SSO.

Local security is under DT (C5I and Security) department, which will also be a partner for the SSO to work with. The space will also have an ISSO to manage the technology in the space.

16. What is the process for requesting and receiving security clearances for personnel?

a. The US Coast Guard manages personnel security (PERSEC) functions primarily through the Integrated Security Management System (ISMS), serving as the central platform for access management, investigation monitoring, self-reporting, and clearance verification. Within the Coast

Guard, SSOs communicate directly to verify clearance information efficiently through ISMS. For external clearance verification involving other agencies, the Coast Guard SSO prepares a formal, signed memorandum containing essential information like full name, date of birth, SSN, clearance level, and purpose/duration of visit, enabling the receiving agency's SSO to verify the clearance via Scattered Castles. Conversely, when personnel from other agencies require access to Coast Guard facilities, the USCG SSO requires a similar memorandum from the visitor's home agency SSO for verification through Scattered Castles. It is crucial to note that unlike the Department of Defense (DoD), the US Coast Guard does not utilize the Defense Information System for Security (DISS).

17. What is the expected turnaround time for clearance processing?

a. Clearance requests are typically processed in the order they are received. To ensure timely processing and access, customers are requested to submit their clearance verification requests a minimum of three business days in advance.

18. What key performance indicators (KPIs) will be used to evaluate the SSO’s performance?

a. KPIs to evaluate the SSO's performance in this non-supervisory role will focus on compliance, security posture, and efficiency in managing daily SCIF operations. These include metrics for self-inspection completion and deficiency resolution, alarm system testing compliance, incident rates (including investigation completion time and thoroughness), accuracy of SCI metrics and document control, timely and accurate processing of incoming/outgoing clearance and visit requests (PERMCERTs), and timely completion of personnel security actions like indoctrinations, debriefings, and vetting packages. Data will be regularly reviewed to identify trends, areas for improvement, and ensure proactive measures are taken to mitigate potential security risks, ensuring a secure and compliant SCIF environment.

19. Are there any historical security audit findings the SSO should be aware of?

a. There is no history since the SCIF is brand new. Any documentation regarding the initial certification of the SCIF and any failures and mitigations will be made available to the SSO.

20. The solicitation does not specify font size requirements for graphics, tables, or captions. May we use a smaller, legible font size for graphics, tables, and captions?

a. There are no specific limits, please use a legible font size.

21. Does the Government expect offerors to propose key personnel by name (e.g., submitting resumes for currently employed or contingent-hire candidates as part of our proposal), or will it be sufficient for offerors to demonstrate in their proposal how they will successfully recruit and staff an individual meeting all requirements locally in Hawaii following contract award?

a. Per Page 9: The contractor shall submit a resume and training certification IAW position description…with their initial proposal.

22. Page Count Exclusions: Will certain sections (e.g., cover letter, table of contents, past performance questionnaires, or representations and certifications) be excluded from the overall proposal page count? May the Government clarify if there are page limits for each proposal component?

a. There are no page limits.

23. Cover Letter: Is a cover letter required with the proposal? If so, in which section or volume should it be included, and will it count towards any page limitations?

a. Not required.

24. Time to Respond After Q&A: Will the Government allow offerors at least 7 calendar days to submit proposals from the date answers to vendor questions are released?

a. Due date has extended until 8/26.